یہ دستاویز صرف انگریزی میں دستیاب ہے۔
Subprocessor List
This page lists the third-party sub-processors that NEXT BASKET engages to help provide its services, as authorised under our Data Processing Addendum. For each sub-processor we identify the provider, the service it performs, the corporate entity, its country and processing location, the categories of personal data involved, and the international transfer mechanism relied on.
Effective date: 23 July 2026
Document version: Version 1.0 — effective 23 July 2026
1. About this list
This list is maintained by Next Basket Platform B.V. (trading as NEXT BASKET AI) and forms part of our Data Processing Addendum (see /data-processing-addendum/, Section 6). It covers the providers that process personal data on our behalf in connection with the nextbasket.com website and the NEXT BASKET platform services.
Website enquiry (lead) data is stored by our backend (Fly.io / Postgres) and notification emails are delivered by Resend; Brevo is not active and is not used. Where CRM synchronisation is enabled, HubSpot is used. A migration of CRM and lead management to Odoo is planned; Odoo will be added to this register only once that integration is activated in production and verified — it is not listed while it processes no live personal data.
Transfer mechanism, per row: where a provider processes personal data within the EEA, that processing is carried out under the provider’s Article 28 data-processing terms. Where a provider processes personal data outside the EEA, we rely on executed European Commission Standard Contractual Clauses with that provider’s specific contracting entity, together with appropriate supplementary measures. Where a provider additionally holds an EU–US Data Privacy Framework certification, that certification is confirmed against the official EU–US Data Privacy Framework registry and is treated only as supplementary information — it is not published as an alternative transfer mechanism.
2. Sub-processor register
The following sub-processors process personal data collected through the nextbasket.com website — its lead forms (contact, demo request, store request and guide download, including the marketing/newsletter opt-in they carry), and its security and analytics functions.
Website sub-processors
| Provider | Service | Corporate entity | Country | Processing location | Data categories | Transfer mechanism | Added |
|---|---|---|---|---|---|---|---|
| Cloudflare | CDN, WAF and edge delivery for the website frontend, and Turnstile anti-bot verification | Cloudflare, Inc. | United States | Global edge network, with United States processing and selected data-localisation settings | IP address, request metadata, Turnstile challenge signals | Executed European Commission Standard Contractual Clauses with Cloudflare, Inc., with appropriate supplementary measures. | 23 July 2026 |
| Fly.io | Hosting for the backend that receives and stores website form submissions (Postgres) | Fly.io, Inc. | United States (provider) | Primary EEA application region where configured, with United States provider operations | Lead data submitted via forms (name, email, company, phone, message) and IP address, in transit and at rest | EEA processing in the configured application region under the provider’s Article 28 terms; for processing by the United States provider entity, executed European Commission Standard Contractual Clauses with Fly.io, Inc., with appropriate supplementary measures. | 23 July 2026 |
| HubSpot | CRM synchronisation, where enabled | HubSpot Ireland Limited, or HubSpot, Inc., as stated in the applicable account agreement | European Economic Area / United States | European Economic Area and United States | Lead contact data (name, email, company, phone, message) | EEA processing under the provider’s Article 28 terms; for processing in the United States, executed European Commission Standard Contractual Clauses with the HubSpot contracting entity, with appropriate supplementary measures. | 23 July 2026 |
| Resend | Transactional email — delivers notification and response emails for website enquiries | Resend, Inc. | United States | United States | Email address and message metadata | Executed European Commission Standard Contractual Clauses with Resend, Inc., with appropriate supplementary measures. | 23 July 2026 |
| Google (Analytics 4) | Website analytics in cookieless mode, only when enabled for the production build; no cookies and no form data in events | Google Ireland Limited, with Google LLC as its United States affiliate | European Economic Area / United States / global | European Economic Area and United States | Pseudonymous, cookieless usage data (pages viewed, approximate IP-derived location); never form data | EEA processing with Google Ireland Limited under Article 28 terms; for processing in the United States by Google LLC, executed European Commission Standard Contractual Clauses, with appropriate supplementary measures. | 23 July 2026 |
3. Platform payment sub-processor (platform-scoped)
The sub-processor below is platform-scoped. It processes billing and payment data for paid NEXT BASKET platform subscriptions and merchant checkout configurations. It does NOT receive ordinary marketing-website lead-form content — the lead-form data described in Section 2 (enquiry, demo request, store request, guide download and the marketing/newsletter opt-in) is not shared with it.
Platform payment sub-processor (platform-scoped)
| Provider | Service | Corporate entity | Country | Processing location | Data categories | Transfer mechanism | Added |
|---|---|---|---|---|---|---|---|
| Stripe | Payment processing for platform checkout and subscriptions (PCI DSS Level 1); platform-scoped only | Stripe Payments Europe, Limited, with the relevant Stripe affiliate as stated in the account agreement | European Economic Area / United States / global | European Economic Area and United States | Billing and payment/card data for paid platform subscriptions and merchant checkout — handled by Stripe, not stored by NEXT BASKET; no marketing-website lead-form content | EEA processing with Stripe Payments Europe, Limited under Article 28 terms; for processing by the relevant United States Stripe affiliate, executed European Commission Standard Contractual Clauses, with appropriate supplementary measures. | 23 July 2026 |
4. Changes to this list and how you are notified
Before we add or replace a sub-processor that will materially process personal data, we give at least 30 days’ advance notice by email to the merchant account administrator and update this page (/subprocessors/).
Merchants may raise a reasonable data-protection objection within 15 days of that notice, as provided in the Data Processing Addendum. For an emergency or security replacement, notice may be shorter or given promptly after the change, and we will explain the reason.
5. Contact
Questions about this list or our sub-processors: Next Basket Platform B.V., Fascinatio Boulevard 216, 3065 WB Rotterdam, Netherlands, or email office@nextbasket.com. See also our Data Processing Addendum (/data-processing-addendum/) and Privacy Policy (/privacy-policy/).